Capturing Data from a Mobile Device in an Off-Network Environment

ABSTRACT

Some aspects of what is described here relate to systems, devices, and computer-implemented methods for capturing data related to a mobile device in a wireless network. In one example, a method may include receiving, at a mobile device, data capture configuration information from a wireless network, the data capture configuration information indicating a data type to be captured from the mobile device in an off-network environment. Thereafter, in response to detecting the off-network environment at the mobile device, a data element is stored in a local memory of the mobile device. The data element corresponds to the data type indicated by the data capture configuration information. The data element is sent to the wireless network, for instance, when the mobile device has access to the wireless network.

CLAIM OF PRIORITY

This application claims priority to EP Patent Application Serial No.15305855.7, filed on Jun. 4, 2015, the entire contents of which arehereby incorporated by reference.

BACKGROUND

This specification relates to capturing data from a mobile device in anoff-network environment.

Mobile devices (also referred to as user equipment or “UE”) on awireless network use network resources from the wireless network tocommunicate with other mobile devices, or use services out of thewireless network (such as, for example, web browsing, informationupload/download, etc.). Examples of such networks are 3GPP networks thatprovide cellular network coverage to mobile devices. Governmentorganizations and/or law enforcement agencies (LEA) (such as, forexample, FBI, UK Home Office, etc.) may lawfully intercept informationrelated to a user of a wireless network. Information capture may beachieved, for instance, through a lawful intercept (LI) processinitiated following court orders triggered by LEAs.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram of an example wireless environment for capturingdata related to a mobile device.

FIG. 2 is a diagram of an example data structure model for data captureconfiguration information.

FIG. 3 is a flow diagram showing an example technique for capturing datafrom a mobile device when the mobile device is in an off-networkenvironment.

FIG. 4 is a flow diagram showing an example technique for capturing datafrom a mobile device when the mobile device is involved in a groupcommunication.

DETAILED DESCRIPTION

Some aspects of what is described here relate to systems, devices, andcomputer-implemented methods for capturing data related to a mobiledevice in a wireless network. In one example, a method may includereceiving, at a mobile device, data capture configuration informationfrom a wireless network, the data capture configuration informationindicating a data type to be captured from the mobile device in anoff-network environment. Thereafter, in response to detecting theoff-network environment at the mobile device, a data element is storedin a local memory of the mobile device. The data element corresponds tothe data type indicated by the data capture configuration information.The data element is sent to the wireless network, for instance, when themobile device has access to the wireless network.

In some implementations, detecting the off-network environment at themobile device includes detecting that the mobile device is outside ofradio coverage provided by the wireless network.

In some implementations, detecting the off-network environment at themobile device includes detecting that the mobile device is utilizingproximity-based wireless services.

In some implementations, the data capture configuration informationindicates a time or time duration parameter for capturing data in theoff-network environment.

In some implementations, the data capture configuration informationindicates a location parameter for capturing data in the off-networkenvironment.

In some implementations, the data capture configuration informationindicates control plane data to be captured from the mobile device in anoff-network environment.

In some implementations, the data capture configuration informationindicates user plane data to be captured from the mobile device in anoff-network environment.

In some implementations, the data element is sent to the wirelessnetwork in response to detecting an upload condition at the mobiledevice while the mobile device has access to the mobile network.

In some implementations, detecting the upload condition includesdetecting a radio resource control of the mobile device being in aconnected mode to communicate data other than the data element.

In some implementations, wherein detecting the upload condition includesdetecting an uplink control plane message to be transmitted by themobile device.

The details of these and other aspects and embodiments of the presentdisclosure are set forth in the accompanying drawings and thedescription below. Other features, objects, and advantages of thedisclosure will be apparent from the description and drawings, and fromthe claims.

In some aspects of what is described here, cellular networks can capturedata related to a target (e.g., a mobile device, a mobile deviceidentifier, an International Mobile Equipment Identity IMEI, anInternational Mobile Subscriber Identity IMSI, a Mobile StationInternational Subscriber Directory Number MSISDN, etc.) when the targetis under network coverage or when the target is off-network. Forinstance, a target in a 3GPP network can be a user entity subscribed toand operating in that 3GPP network, a user equipment operating in that3GPP network (e.g., a HPLMN or a VPLMN), or a user roaming from another3GPP network or from any other network capable of using that 3GPPnetwork. The data capture process can be, for example, a lawfulintercept (LI) process initiated by a law enforcement agency (LEA) oranother type of data capture process.

The captured data can, for example, include user plane information,control plane information, or possibly other types of information. Theuser plane information may include information such as user-generatedcommunication content (such as content of SMS received or sent) and/orcontent of conversation initiated as a caller or called party. Thecontrol plane information may include location information of the userand/or session control information (such as phone numbers called, etc.)In this situation, the cellular network may act as a forwarding entityand a delivery function of the law enforcement agency (LEA) thatforwards data to the LEA as the cellular network receives/sends the datafrom/to a target mobile device. Although illustrated in 3GPP E-UTRANRadio Access Technology (RAT), implementations of the subject matterdescribed in this specification can be implemented in other RATs orother systems, including but not limited to, 3GPP UTRAN, 3GPP GERAN,IEEE 802.11x, CDMA2000, and others.

In some cases, data capture techniques can avoid or otherwise reduce thepossibility of data tempering by the target mobile device. For instance,in some cases, the target mobile device cannot delete or modify thecaptured information, and the user of the target mobile device is notaware that the interception is occurring on the target mobile device. Insome instances, these and other advantages can help avoid behavioralcountermeasures from the intercepted target.

In the 3GPP Rel-12, for example, the work item of Device to Device (D2D)Proximity-based Services (ProSe) is introduced to allow ProSe directcommunication between two or more ProSe-enabled UEs. When the UEs are indirect communication range, the UEs can communicate with each otherusing a direct communication path between the UEs without involving the3GPP network. The UEs on ProSe communication can communicate via theUE-to-UE direct PC5 interface.

In addition, Public Safety UEs may be able to establish a communicationpath directly between two or more Public Safety (ProSe-enabled) UEs,even if those UEs are not served by 3GPP E-UTRAN. Public Safety UEs maybe UEs operated by “First Responders” whose aim is to protect citizensand/or allow law enforcement. Examples of such “First Responders” using“Public Safety UEs” are Policemen, Ambulances, Firemen, or MountainRescuers. For example, the First Responder Network Authority, FirstNet,was created under the US National Telecommunication & InformationAdministration (NTIA) to implement a nationwide interoperable publicsafety broadband network for First Responders.

In ProSe communication, UEs may communicate directly, for example, viathe PC5 interface. The 3GPP E-UTRAN is not in the PC5 path and may notbe able to forward LI information when the target mobile device is inProSe communication. In addition, Public Safety and First Responder UEsare not exempt from being potentially subject to LI. In some cases, LImay be required, for example, for post-mortem analysis of an emergencyevent, and/or for liability purposes. Therefore, there is a need for LIto be possible on Public Safety UEs and/or non-Public Safety UEs using,for example, ProSe communication both when the Public Safety UEs and/ornon-Public Safety UEs are under, for example, the 3GPP network coverageand when the Public Safety UEs and/or non-Public Safety UEs are out of,for example, the 3GPP network coverage, in addition to theunder-coverage need for LI for all UEs. UEs involved in a groupcommunication or ProSe communication may be all in coverage or out ofcoverage, or some of them may be in coverage while the others are out ofcoverage (partial coverage).

When the target UE is in ProSe communication, traditional interceptionof communication/data may not be possible at the source by the Network.For example, this may be because the ProSe data traffic may not traversethe Network. Instead, in some examples, the ProSe data traffic istransmitted over the PC5 interface between the UEs. In such cases, thetarget UE may receive data capture configuration information from thenetwork while under the network coverage. In some implementations, thedata capture configuration information may indicate at least a data typeto be captured from the target mobile device in an off-networkenvironment (such as in ProSe communication whether under coverage orout of coverage). When in an off-network environment, the target mobiledevice may be triggered to store data locally based on the data captureconfiguration information. A mobile device may include a MobileEquipment (ME) and a Universal Subscriber Identity Module (USIM). Thedata stored at the target mobile device may be stored, for example, atthe ME and/or at the USIM of the target mobile device. The stored datamay be uploaded to the network at a later time, such as when the targetmobile device has access to the network.

When the target UE uploads captured data without any precaution, it mayincrease the detectability of the interception by the user of the targetUE. For example, if the target UE uploads captured data without anyprecaution when the target UE regains network access, the target UE maystart to upload data when it should not. In some cases, the uploadingmay lead to a change in the state of the target UE, such as, forexample, in the 3GPP LTE terminology, the RRC state of the target UEwould change from RRC Idle to RRC Connected. The change of the RRC statemay lead to changes in behaviors of the target UE, such as, for example,measurement reports via RRC messages sent by the target UE towards thenetwork. The target UE sending data via messages towards the network maybe detected by the user of the target UE. In some cases, the user maydownload some applications that keep track of the RRC state of the UEthe user is using. By noticing the UE switching to RRC connected stateinexplicably, the user may suspect that his communications/data wasintercepted. The sudden upload of data when the device is supposed to beidle may increase battery consumption of the device, that may bedetected by the user of the target UE.

In some implementations, the target UE may apply an intentional delayfor uploading the stored data. For example, the target UE may wait for apre-defined period of time after the target UE regains network accessbefore uploading the stored data. In some instances, once in coverage,the target UE waits to be in Connected mode (also referred to as RRCConnected, Connected mode) by other actions (e.g., making a call) beforeuploading the stored data. By implementing the intentional delay, thetarget UE may not switch from idle to connected mode for the solepurpose of uploading the stored data.

When the target UE stores data locally whether, for example, at the MEand/or at the USIM of the target UE, the user of the target UE maydetect the interception and may try to tamper with the stored data. Asone possible solution, intercepted data may be stored at other UEs. Insome implementations, distributed recording is applied to a number ofUEs that are involved in communications with the target UE. In thedistributed recording, a split may be defined between the UEs as towhich UE records what. The distributed recording may reduce the amountof data to be stored by each UE, mitigate the storage requirement perUE, shorten the uploading time per UE, and thus may decrease the chanceof detectability by the user of the target UE.

In some implementations, duplicated recording is applied to the UEs. Inthe duplicated recording, more than one UE will record specific data.The LEA may acquire several copies of the specific data from differentUEs, and by cross-referencing the several copies, the LEA may haveincreased confidence in the intercepted data. Even if the user of thetarget UE succeeds in tampering with the stored date at the target UE,duplicated data stored at other UEs may provide more reliable recoveryof the untampered intercepted data.

In some implementations, data is not stored by the target UE. Instead,another UE involved in the communication with the target UE may storethe data. In such scenarios, which may be referred to as recording byother side(s) (ROS), the target UE neither stores nor uploads the data.The ROS scenario may decrease the detectability of recording and upload,as seen by the user of the target UE.

FIG. 1 is a block diagram of an example wireless environment 100 forcapturing data related to a mobile device. The example wirelessenvironment 100 includes a wireless network 112 and a number of mobiledevices 116 (such as 116 a, 116 b, 116 c, 116 d, 116 e and 116 f shownin FIG. 1). The wireless environment 100 can include additional wirelessnetworks connected to each other through a network, not shown in FIG. 1.The wireless environment 100 can include more or fewer mobile devices.Accordingly, six mobile devices 116 are depicted in FIG. 1 employingvarious example methods of communication.

As illustrated, the wireless network 112 includes an example networkserver 114. In some instances, the wireless network 112 may includeadditional network servers. The example network server 114 facilitateswireless or wireline communications between the components of thewireless environment 100 (e.g., between mobile devices 116, and amongothers), as well as with any other local or remote computer, such asadditional mobile devices, servers, or other devices communicablycoupled to wireless network 112, including those not illustrated inFIG. 1. In the illustrated environment, the wireless network 112 isdepicted as a single network, but may be comprised of more than onenetwork. In some instances, at least a portion of the wireless network112 may represent a connection to the Internet. Further, all or aportion of the wireless network 112 can include either a wireline orwireless link. Example wireless links may include802.11ac/ad/af/a/b/g/n, 802.20, WiMax, LTE, and/or any other appropriatewireless link. The wireless network 112 may communicate, for example,Internet Protocol (IP) packets, Frame Relay frames, AsynchronousTransfer Mode (ATM) cells, voice, video, data, and other suitableinformation between network addresses.

As illustrated, network server 114 includes an interface 130, aprocessor 132, and memory 134. In general, the network server 114 is arepresentation of one or more systems and/or servers that provide thedescribed functionality, and is not meant to be limiting, but rather anexample of the systems possible.

The example interface 130 is used by the network server 114 forcommunicating with other systems in a distributed environment—includingwithin the environment 100—connected to the wireless network 112, e.g.,mobile device(s) 116 and other systems communicably coupled to thewireless network 112. Generally, the interface 130 includes logicencoded in software and/or hardware in a suitable combination andoperable to communicate with the network server 114. More specifically,the interface 130 may include software supporting one or morecommunication protocols associated with communications such that thenetwork server 114 or interface's hardware is operable to communicatephysical signals within and outside of the illustrated environment 100.

As illustrated in FIG. 1, the network server 114 includes a processor132. Although illustrated as a single processor 132 in FIG. 1, two ormore processors may be used according to particular needs, desires, orparticular implementations of the environment 100. Each processor 132may be a central processing unit (CPU), an application-specificintegrated circuit (ASIC), a field-programmable gate array (FPGA), oranother suitable component. Generally, the processor 132 executesinstructions and manipulates data to perform the operations of thenetwork server 114. Specifically, the processor 132 executes thealgorithms and operations, including the operations performing thefunctionality associated with the network server 114 generally,including the functionality for sending communications to and receivingtransmissions from mobile device(s) 116.

As illustrated, the example network server 114 includes memory 134. Thememory 134 may include any memory or database module and may take theform of volatile or non-volatile memory including, without limitation,magnetic media, optical media, random access memory (RAM), read-onlymemory (ROM), removable media, or any other suitable local or remotememory component. The memory 134 may store various objects or data,including financial and/or business data, user information, behavior andaccess rules, administrative settings, password information, caches,applications, backup data, repositories storing business and/or dynamicinformation, and any other appropriate information including anyparameters, variables, algorithms, instructions, rules, constraints, orreferences thereto associated with the purposes of mobile device(s) 116.Additionally, the memory 134 may store other appropriate data, such asVPN applications, firmware logs and policies, firewall policies, asecurity or access log, print or other reporting files, as well asothers.

As illustrated, the example wireless network 112 has a coverage area110. As shown in FIG. 1, four mobile devices (116 a, 116 b, 116 c, and116 d) are under the coverage of the wireless network 112. Two mobiledevices (116 e and 116 f in FIG. 1) are out of the coverage area of thewireless network 112. Among the four under-coverage mobile devices, twomobile devices (116 a and 116 b) are using network resources from thewireless network 112 to communicate with other mobile devices. Forexample, mobile device 116 a can communicate with mobile device 116 bthrough a wireless link 118 a between the mobile device 116 a and thewireless network 112, and a wireless link 118 b between the mobiledevice 116 b and the wireless network 112. In some instances, mobiledevice 116 a can communicate with other mobile devices in anothernetwork through the wireless link 118 a. For mobile devices 116 a and/or116 b communicating through links with the wireless network 112, thewireless network 112 can act as a forwarding entity and forward data tothe LEA as the wireless network 112 receives/sends the data from/tomobile devices 116 a and/or 116 b if mobile devices 116 a and/or 116 bare identified as target.

In some instances, mobile device 116 c and mobile device 116 d maycommunicate with each other through a direct communication path 118 c(such as, for example, a ProSe communication link as in 3GPP Rel-12)without involving the wireless network 112 as illustrated in FIG. 1. Useof the direct communication path 118 c is an example of operating in anoff-network wireless environment. Even though both mobile devices (116 cand 116 d) are under the coverage of the wireless network 112, thecommunication between them may not be directly observed by the wirelessnetwork 112. In some implementations, data may be captured by the targetmobile device involved in a communication with the target mobile device.

As illustrated, the example mobile devices 116 e and 116 f maycommunicate with each other through a direct communication path 118 d(such as a ProSe communication link in 3GPP Rel-12) when both mobiledevices (116 e and 116 f) are out of the coverage area 110 of thewireless network 112. Operating in a location outside the coverage areais an example of operating an off-network environment. Use of the directcommunication path 118 d is another example of an operating in anoff-network environment. In some instances, one of the two mobiledevices (for example, 116 e) may be located within the coverage area 110while the other (for example, 116 f) is located outside the coveragearea 110. In any these example off-network environments, data may becaptured by a mobile device whether it is the target mobile device orthe mobile device involved in a communication with the target mobiledevice.

As illustrated in FIG. 1, the example mobile devices 116 include awireless interface 120, a graphical user interface (GUI) 122, aprocessor 124, and memory 126. Wireless interface 120, processor 124,and memory 126 may be similar to or different than the interface 130,processor 132, and memory 134 described with regard to network server114. In general, processor 124 executes instructions and manipulatesdata to perform the operations of the mobile device 116. Similarly,wireless interface 120 provides the mobile device 116 with the abilityto communicate with other systems in a distributed environment—includingwithin the environment 100—connected to the wireless network 112, aswell as the ability to communicate with other systems directly within acommunication range. Memory 126 provides the mobile device 116 withstorage, e.g., for data capture configuration information, capture dataelements, or other information from a target mobile device.

The illustrated mobile device 116 is intended to encompass any computingdevice such as a desktop computer, laptop/notebook computer, mobiledevice, smartphone, personal data assistant (PDA), tablet computingdevice, one or more processors within these devices, or any othersuitable processing device capable of sending and receiving electronicmessages. For example, the mobile device 116 may be a computer thatincludes an input device, such as a keypad, touch screen, or otherdevice that can accept user information, and an output device thatconveys information associated with the operation of the mobile device116 itself, including digital data, visual information, or a GUI 122, asshown with respect to the mobile device 116.

The wireless network 112 may indicate to a mobile device 116 informationabout LI data including the type of data that the network wants tointercept during the period when the mobile device is in an off-networkenvironment. This may be referred to as data capture information. Theinformation can be sent to the mobile device, for example, in NASmessages (e.g., 24.301), or to the USIM/eUSIM of the mobile device viaSIM toolkit download (e.g., Application Toolkit 3GPP TS 31.111). If theinformation is stored in the USIM of the mobile device, those fieldscould be added to the ME-USIM interface 3GPP TS 31.102. In someinstances, the mobile device may save the information as data captureconfiguration information that may be received during on-network timesand then re-used later when the mobile device is in an off-networkenvironment. The data capture configuration information may be sent fromthe network to the mobile device while the mobile device is under thecoverage of the network and may be re-used later when the mobile devicedetermines that it is in an off-network environment.

In some implementations, the mobile device may use the data captureconfiguration information to collect specific LI data and ignore otherdata not flagged as needed for LI purposes. The parameters in theconfiguration information may be used to control the type of datacaptured and the amount of resources used on the mobile device to storecaptured data while the mobile device is in an off-network environment.In some instances, when the mobile device regains network access, it mayuse the configuration to upload appropriate data to the network. In someinstances, the data capture configuration information may be containedin a secure location or some protected part of the mobile device'sstorage (such as the memory 126).

FIG. 2 is a diagram showing an example of a data structure model 200 fordata capture configuration information. In some instances, the datastructure model 200 is used to store data captured from a mobile devicein an off-network environment, an in-network environment, from a groupcommunication, or in another context. For instance, the data structuremodel 200 can be used for lawful intercept by any of the example mobiledevices 116 shown in FIG. 1, or in another type of wireless environment.Other types of data structures may be used.

The example data structure model 200 contains one or more LI profiles202. Each LI profile includes a Subscriber_ID field 204, a Data_capturefield 206, and a Policy field 208. The Subscriber_ID field 204 containsan ID field 210 which indicates a target mobile device's identity (suchas the USIM number of the target mobile device). The Data_capture field206 includes a Data Type field 212 and an App_ID field 214. The DataType field 212 includes LI data information, such as, for example,priority, data type, destination address, receiving address, and groupaddress. The App_ID field 214 includes application information of PLdata, such as, for example, priority, OSid, and an ID field 216 whichindicates an application identity. The Policy field 208 may containrules on how to store the LI data.

FIG. 3 is a flow diagram showing an example process 300 for capturingdata from a mobile device when the mobile device is in an off-networkenvironment. The process 300 can be implemented in a communicationsystem. For example, the process 300 can be implemented by one or morecomponents of the communication system 100 shown in FIG. 1 or by adifferent type of system. In some cases, some or all aspects of theprocess 300 can be executed by a wireless terminal (e.g., the mobiledevice 116 of FIG. 1) or another type of wireless terminal. In somecases, the process 300 can be executed by multiple components, devices,or subsystems of the type shown in FIG. 1, or components, devices, orsubsystems of additional or different types.

The example process 300 shown in FIG. 3 can be modified or reconfiguredto include additional, fewer, or different operations, which can beperformed in the order shown or in a different order. In some instances,one or more of the operations can be repeated or iterated, for example,until a terminating condition is reached. In some implementations, oneor more of the individual operations shown in FIG. 3 can be executed asmultiple separate operations, or one or more subsets of the operationsshown in FIG. 3 can be combined and executed as a single operation.

At 305, data capture configuration information is received by a mobiledevice. The mobile device can receive the data capture configurationinformation from a wireless network, such as, for example, a cellularnetwork, when the mobile device is located in a coverage area of thecellular network. In some cases, when the mobile device is locatedoutside the coverage area of the cellular network, the data captureconfiguration information can be received from another mobile devicehaving a communication link with the mobile device. In someimplementations, some or all of the data capture configurationinformation includes the type of data structure shown in FIG. 2. Othertypes of data capture configuration information can be used.

The data capture configuration information can indicate a timeparameter, such as a begin/end time, a duration, etc., for capturingdata. In some implementations, the data capture configurationinformation can indicate a location parameter, such as a cell ID, GPScoordinates, location area, RAT type, etc., for capturing data. In someimplementations, the data capture configuration information can indicatecontrol plane data, such as voice signaling, data signaling, etc., to becaptured. In some implementations, the data capture configurationinformation can indicate user plane data, such as SMS, data, video,voice, etc., to be captured. In some cases, when the mobile device is inan off-network environment (e.g., located outside the coverage area ofthe cellular network, located inside the coverage area of the cellularnetwork but utilizing proximity-based wireless services, etc.), the datacapture configuration information can provide instructions on capturingdata in the off-network environment.

At 310, the mobile device detects that it is in an off-networkenvironment. This detection may happen as a result of one or moretriggers as described below. The off-network environment may be detectedby detecting that the mobile device is outside of radio coverageprovided by a wireless network. The detection of off-network environmentmay also be detected by detecting that the mobile device is utilizingproximity-based wireless services. In some instances, the detection ofoff-network environment causes the mobile device to invoke storage of LIdata at the mobile device.

In some implementations, the mobile device can operate in ProSE/MCPTT(Mission Critical Push To Talk) mode. For instance, 3GPP SA2 has definedfour modes of operation related with ProSe. The modes are as follows:

1. Network-mode operation (NMO): MCPTT mode of operation where themobile device is served directly by E-UTRAN and uses MCPTT serviceprovided by the network;

2. Network-mode operation via relay (NMO-R): MCPTT mode of operationwhere the mobile device is served by a ProSe UE-to-Network Relay anduses MCPTT service provided by the network;

3. Direct-mode operation (DMO): MCPTT mode of operation where the MCPTTservice is supported over ProSe Communication paths without networkinvolvement;

4. Direct-mode operation via relay (DMO-R): MCPTT mode of operationwhere the mobile device is served by a ProSe UE-to-UE Relay and theMCPTT service is supported over ProSe Communication paths withoutnetwork involvement.

In some instances, triggers may be activated when the mobile device isin Direct Mode of Operation (via Relay or not) or in NMO-R. When thosetriggers are activated the mobile device is aware that it has to use thedata capture configuration information to store LI data. In other words,the control plane and user plane information sent/received by the mobiledevice are not going through the network when the mobile device is inthose modes and LI data has to be stored at the mobile device if datacapture information applies. In some instances, triggers may beactivated when the NMO-R/DMO/DMO-R are effectively set up and after themobile device receives messages that set up those modes from othermobile device, any Relay, or the MCPTT server. For example after thatthe device is configured by upper layers (e.g. ProSe function orinitiated by user) to transmit or receive on the Sidelink shared channel(SL-SCH) that is a channel that is used for direct device-to-devicecommunication in any of those three modes. The mobile device, in DMO orDMO-R, is not communicating with the network and may use the datacapture configuration information previously received to assess whichinformation (and possibly when) has to be stored and uploaded later. InNMO-R not all data channels communicate with the network and thereforesame principle may apply. As an alternative, the device beingtransmitting or receiving on the SL-SCH (rather than having simply theSL-SCH configured) may be used as a trigger. As an alternative, thedevice being configured in other modes, or other mode combinations thanDMO/DMO-R/NMO-R, is also possible to be used as a trigger.

In some implementations, another trigger for the mobile device to assessthat it is outside of radio coverage of a serving cell may be used. Anumber of sub-triggers, which may be used instead or in conjunction withthe other trigger, are listed below:

1. Serving cell not suitable. Following criteria from TS 36.304, for theexample of LTE.

2. Serving cell not acceptable. Following criteria from TS 36.304, forthe example of LTE.

3. Cell Selection criteria S not fulfilled. Following criteria from TS36.304, for the example of LTE. This could apply to the Primary Cell orSecondary Cells.

4. The mobile device is in “Any Cell Selection state.”

5. The mobile device is in “Camped on Any Cell state.”

The detection of an off-network environment may be the result of one ormore of the triggers listed above. Each of the listed criteria may beused independently, or in conjunction with the others, for the detectionof an off-network environment. When more than one of the listed criteriaare used in conjunction, the detection may be triggered, for example,when one of the criterion is fulfilled, or when all of the criteria arefulfilled.

At 315, a data element is stored in a local memory of the mobile devicebased on the data capture configuration information. The data elementincludes information sent and/or received by the mobile device, such as,for example, recordings of metadata, voices, videos, or images, when themobile device is in the off-network environment.

At 320, the mobile device detects that it has access to the network. Thedetection of network access may, for example, be detecting that themobile device is entering a radio coverage area provided by a wirelessnetwork. In some instances, the detection of network access may bedetecting that the mobile device changes its state to network-mode. Insome instances, the detection of network access causes the mobile deviceto upload stored LI data at the mobile device to the network.

At 325, the data element is sent to the wireless network. In someinstances, the data element is sent to the wireless network, forexample, in response to detecting an upload condition at the mobiledevice while the mobile device has access to the mobile network. Forexample, the upload condition may be detected by detecting a radioresource control of the mobile device being in a connected mode tocommunicate data other than the data element. In some instances, theupload condition may be detected by detecting an uplink control planemessage to be transmitted by the mobile device for a reason differentthan Lawful Interception. A control plane message is a message thatincludes control information such as, for example, an Attach Requestmessage or Tracking Area Update Request message.

In some implementations, an intentional delay may be applied whensending the data element to the wireless network. In some instances, themobile device may wait for a pre-defined period of time or wait to be ina connected mode by other actions, such as, for example, a mobileoriginating or terminating call or a browsing session, before uploadingthe stored data. For example, in some instances, once the PC5 interfaceis no long being used (i.e., mobile device is not communicating usingProSe), the mobile device may wait to be in RRC Connected mode by otheractions (such as a mobile originating or terminating call or a browsingsession) before uploading the data element.

In some implementations, a logical channel may be applied when sendingthe data element to the wireless network. When uploading the dataelement to the network, the mobile device may use the same logicalchannels (e.g., LCID in MAC) or logical channel groups (e.g., LCG ID inMAC) that would normally be used for other user data/control planemessages (e.g. LCG used for an SRB or for any other data traffic likeVoIP data etc.) to upload the data element.

In some implementations, the mobile device may use the Access Point Name(APN) specified for normal data traffic to upload the data element tothe network. In some other implementations, the data element may beincluded in an uplink Control Plane message, such as, for example, theTAU Request message. This could be especially useful, for instance, whenthe upload data element is reasonably small, for example, limited toonly LI Control Plane information (such as the IRI).

FIG. 4 is a flow diagram showing an example process 400 for capturingdata from a mobile device when the mobile device is involved in a groupcommunication. Similar process may apply if the mobile device isinvolved in ProSe communication. The process 400 can be implemented in acommunication system. For example, the process 400 can be implemented byone or more components of the communication system 100 shown in FIG. 1or by a different type of system. In some cases, some or all aspects ofthe process 400 can be executed by a wireless terminal (e.g., the mobiledevice 116 of FIG. 1) or another type of wireless terminal. In somecases, the process 400 can be executed by multiple components, devices,or subsystems of the type shown in FIG. 1, or components, devices, orsubsystems of additional or different types.

The example process 400 shown in FIG. 4 can be modified or reconfiguredto include additional, fewer, or different operations, which can beperformed in the order shown or in a different order. In some instances,one or more of the operations can be repeated or iterated, for example,until a terminating condition is reached. In some implementations, oneor more of the individual operations shown in FIG. 4 can be executed asmultiple separate operations, or one or more subsets of the operationsshown in FIG. 4 can be combined and executed as a single operation.

At 405, data capture configuration information is received by a mobiledevice. The data capture configuration information indicates a targetmobile device from which data is to be captured during groupcommunication between the mobile device and the target mobile device.The mobile device can receive the data capture configuration informationfrom a wireless network, such as, for example, a cellular network, whenthe mobile device is located in a coverage area of the cellular network.In some cases, when the mobile device is located outside the coveragearea of the cellular network, the data capture configuration informationcan be received from another mobile device, including the target mobiledevice, having a communication link with the mobile device. In someimplementations, some or all of the data capture configurationinformation includes the type of data structure shown in FIG. 2. Othertypes of data capture configuration information can be used.

The data capture configuration information can indicate a timeparameter, such as a begin/end time, a duration, etc., for capturingdata. In some implementations, the data capture configurationinformation can indicate a location parameter, such as a cell ID, GPScoordinates, location area, RAT type, etc., for capturing data. In someimplementations, the data capture configuration information can indicatecontrol plane data, such as voice signaling, data signaling, etc., to becaptured. In some implementations, the data capture configurationinformation can indicate user plane data, such as SMS, data, video,voice, etc., to be captured. In some cases, when the mobile device is inan off-network environment, such as located outside the coverage area ofthe cellular network, located inside the coverage area of the cellularnetwork but operated in direct-mode (DMO), etc., the data captureconfiguration information can provide instructions on capturing data inthe off-network environment.

At 410, a group communication between the mobile device and the targetmobile device is detected. This is, for example, allowed by the GroupCommunications System Enablers for LTE (GCSE_LTE). The groupcommunication can be a communication session (e.g., a voice call, avideo conference, etc.) between two or more mobile devices. In somecases, the group communication can involve only the mobile device andthe target mobile device. In some cases, the group communication caninvolve additional mobile devices. Similar principles may re-apply fortwo mobile devices if the two mobile devices are involved in ProSecommunication.

At 415, a data element is stored in a local memory of the mobile devicebased on the data capture configuration information. The data elementincludes information from the group communication between the mobiledevice and the target mobile device, such as, for example, recordings ofmetadata, voice data, videos or images. In some cases, the data elementincludes data transmitted between the mobile device and the targetmobile device, such as, for example, from the mobile device to thetarget mobile device, from the target mobile device to the mobiledevice, or both, while the target mobile device operates in anoff-network environment.

In some cases, the target mobile device can store additional data in itslocal memory. For instance, the target mobile device can store anadditional data element that includes additional information from thegroup communication between the mobile device and the target mobiledevice. In some instances, the additional information may include thecontrol plane information, such as, for example, the location of thetarget mobile device, which may not be available at the other mobiledevice.

In some implementations, when multiple mobile devices participate in thegroup communication with the target mobile device in an off-networkenvironment, data transmitted between the multiple mobile devices andthe target mobile device can be stored in local memories of the multiplemobile devices. Similar process may apply for two mobile devices inProSe communication. In some cases, each of the multiple mobile devicescan store the whole data element. In some cases, each of the multiplemobile devices can store a portion of the data element, for example,according to predetermined rules. One example of a predetermined rulecan be defined for each of the multiple mobile devices to store data ata different time according to a common timing reference, such as, forexample, GPS time reference, UTC, System Frame Number (SFN), or DirectFrame Number (DFN).

In some implementations, distributed recording is applied among themultiple mobile devices. In the distributed recoding, one of the mobiledevices involved in the communication may record data at a timeaccording to a predetermined rule. Thus, in this implementation, each ofthe mobile devices (or a subset thereof) will record a different pieceof the data to be captured. This applies, for example, for two mobiledevices in the case of ProSe communication. In another example, inoff-network operation, multiple mobile devices in a group communicationcommunicate with each other. More than one mobile device in the groupcommunication may record the conversation and the mobile devicerecording the communication or other LI information at a given time maychange according to the predetermined rule. For example, eight mobiledevices may be involved in off-network group communication. The firstmobile device may record during the first period, the second mobiledevice may record during the second period, and so on. In someinstances, the recording mobile device may include a digital signatureinto the recording to ensure authenticity of the recording. The digitalsignature may be computed based, for example, on at least part of agroup communication key, the identity of the mobile device, the ME, orthe USIM of the mobile device.

An example of the predetermined rule is described. For DFN timingreference, one mobile device involved in the group communication countsthe total number of mobile devices, N_(u), in the group communication,and provides this number to other mobile devices via a channel read byother mobile devices. The channel may, for example, be a channelproviding master information block for slide link direct communicationor the Side Link Broadcast Channel SL-BCH. When each mobile device joinsthe group communication, identified for example by an identificationnumber such as by ProSe L2 group ID, each mobile device may be given adifferent index i by the mobile device which is the moderator of thegroup communication. The index i may range, for example, from 0 to(N_(u)−1). The mobile device with the index i records the groupcommunication during the DFN that validates the following formula:

DFN mod N_(u)=i.

In this example, each recording duration is equal to the duration of aDFN, e.g., 10 ms. In some instances, the recording duration for eachmobile device could be different. Media has to be recorded for the DFNvalues that validate:

(Floor(DFN/2))mod N _(u) =i.

Other time allocations or formulas are possible. For example, if half ofthe mobile devices in the group communication record the session, theformula could become:

DFN mod(N _(u)/2)=i.

When one mobile device leaves the group communication or is about tolose the common time reference from the mobile device providing thecommon time reference, sometimes known as SyncRef UE, the mobile devicemay broadcast to other mobile devices (using, for example, the ProseL2group Id) that it has left the coverage of other mobile devices. Theother mobile devices remaining in the group communication may know thenew total number of mobile devices and the new time allocation to use.In some instances, all mobile devices remaining in the groupcommunication would have their index i re-assigned. In some otherinstances, only some of the mobile devices remaining in the groupcommunication may have their index i re-assigned. In some instances, theleaving mobile device may indicate its index, for example, to theProseL2 group Id. In some cases, the mobile device with the highestindex (e.g., equal to (N_(u)−1)) may change its index to the index ofthe leaving mobile device.

In some implementations, duplicated recording is applied among themultiple mobile devices. In the duplicated recoding, more than onemobile device may record the same LI information. For example, at agiven time, more than one mobile device may record LI data. If therecording of a certain duration is made by multiple mobile devices,recording can be replicated for, possibly, more reliable recovery of thespecific LI information. In some instances, the LEA may upload severalcopies of the recorded communication from different mobile devicesinvolved in the group communication. By cross-referencing the severaluploads, the LEA may have greater confidence in the intercepted data.For example, if all copies uploaded from different mobile devices arethe same, the LEA may have greater confidence that the intercepted datahas not been tampered. Otherwise, at least one copy has beencompromised.

An example of a generalized distributed recording is described. The goalis to have more than one copy of the communication data recorded by thegroup of mobile devices. Using the example described above, oneimplementation may be as follows:

N_(u) mobile devices are given the indexes i ranging from 0 to N_(u)−1;

The mobile device with index i records the group communication for theDFNs for which one (or more) of the two formulas below is true:

(Floor(DFN/2))mod N _(u) =i.

Or:

(Floor(DFN/2))mod N _(u) =i+1 (or=0 if i+1=N _(u)).

In some other instances, duplication of recording information may beperformed by two or more mobile devices without defining time periods,such as, for example, for Control Plane information. Each mobile devicemay be instructed to record similar relevant information (such as, forexample, location information of each mobile device).

In some instances, distributed recording and duplicated recording areused separately. In some other instances, distributed recording andduplicated recording are used together. For example, if six mobiledevices are in a group communication, mobile devices 0 and 1 may recordperiodically a first third of group communication, mobile devices 2 and3 may record periodically a second third, and mobile devices 4 and 5 mayrecord periodically a last third.

In some implementations, ROS is applied among the multiple mobiledevices. In the ROS, LI data may not be stored by the target mobiledevice but by another mobile device having the group communication withthe target mobile device. The ROS may apply when two mobile devices arein communication (for example, using ProSe communication, notnecessarily a group communication, or using group communication at twomobile devices), or more than two mobile devices are in a groupcommunication. In some instances, one or more mobile device may beconsidered as the “other side” mobile device(s).

At 420, the data element is sent to the wireless network. In some cases,the data element is sent to the wireless network in response todetecting an upload condition at the mobile device while the mobiledevice has access to the mobile network, for example, when the mobiledevice's mode of operation is changed from direct-mode operation tonetwork-mode operation, as defined in 3GPP SA2. In some cases, when thetarget mobile device has stored additional data element in its localmemory, the target mobile device sends the additional data element tothe wireless network.

Implementations of the subject matter and the functional operationsdescribed in this specification can be implemented in digital electroniccircuitry, in tangibly embodied computer software or firmware, incomputer hardware, including the structures disclosed in thisspecification and their structural equivalents, or in combinations ofone or more of them. Implementations of the subject matter described inthis specification can be implemented as one or more computer programs,i.e., one or more modules of computer program instructions encoded on atangible, non-transitory computer-storage medium for execution by, or tocontrol the operation of, data processing apparatus. Alternatively or inaddition, the program instructions can be encoded on an artificiallygenerated propagated signal, e.g., a machine-generated electrical,optical, or electromagnetic signal that is generated to encodeinformation for transmission to suitable receiver apparatus forexecution by a data processing apparatus. The computer-storage mediumcan be a machine-readable storage device, a machine-readable storagesubstrate, a random or serial access memory device, or a combination ofone or more of them.

The terms “data processing apparatus,” “computer,” or “electroniccomputer device” (or equivalent as understood by one of ordinary skillin the art) refer to data processing hardware and encompass all kinds ofapparatus, devices, and machines for processing data, including by wayof example, a programmable processor, a computer, or multiple processorsor computers. The apparatus can also be or further include specialpurpose logic circuitry, e.g., a central processing unit (CPU), an FPGA(field programmable gate array), or an ASIC (application specificintegrated circuit). In some implementations, the data processingapparatus and/or special purpose logic circuitry may be hardware-basedand/or software-based. The apparatus can optionally include code thatcreates an execution environment for computer programs, e.g., code thatconstitutes processor firmware, a protocol stack, a database managementsystem, an operating system, or a combination of one or more of them.The present disclosure contemplates the use of data processingapparatuses with or without conventional operating systems, for exampleLINUX, UNIX, WINDOWS, MAC OS, ANDROID, IOS or any other suitableconventional operating system.

A computer program, which may also be referred to or described as aprogram, software, a software application, a module, a software module,a script, or code, can be written in any form of programming language,including compiled or interpreted languages, or declarative orprocedural languages, and it can be deployed in any form, including as astandalone program or as a module, component, subroutine, or other unitsuitable for use in a computing environment. A computer program may, butneed not, correspond to a file in a file system. A program can be storedin a portion of a file that holds other programs or data, e.g., one ormore scripts stored in a markup language document, in a single filededicated to the program in question, or in multiple coordinated files,e.g., files that store one or more modules, sub programs, or portions ofcode. A computer program can be deployed to be executed on one computeror on multiple computers that are located at one site or distributedacross multiple sites and interconnected by a communication network.While portions of the programs illustrated in the various figures areshown as individual modules that implement the various features andfunctionality through various objects, methods, or other processes, theprograms may instead include a number of sub-modules, third-partyservices, components, libraries, and such, as appropriate. Conversely,the features and functionality of various components can be combinedinto single components as appropriate.

The processes and logic flows described in this specification can beperformed by one or more programmable computers executing one or morecomputer programs to perform functions by operating on input data andgenerating output. The processes and logic flows can also be performedby, and apparatus can also be implemented as, special purpose logiccircuitry, e.g., a CPU, an FPGA, or an ASIC.

Computers suitable for the execution of a computer program can be basedon general or special purpose microprocessors, both, or any other kindof CPU. Generally, a CPU will receive instructions and data from a readonly memory (ROM) or a random access memory (RAM) or both. The essentialelements of a computer are a CPU for performing or executinginstructions and one or more memory devices for storing instructions anddata. Generally, a computer will also include, or be operatively coupledto, receive data from or transfer data to, or both, one or more massstorage devices for storing data, e.g., magnetic, magneto optical disks,or optical disks. However, a computer need not have such devices.Moreover, a computer can be embedded in another device, e.g., a mobiletelephone, a personal digital assistant (PDA), a mobile audio or videoplayer, a game console, a global positioning system (GPS) receiver, or aportable storage device, e.g., a universal serial bus (USB) flash drive,to name just a few.

Computer-readable media (transitory or non-transitory, as appropriate)suitable for storing computer program instructions and data include allforms of nonvolatile memory, media and memory devices, including by wayof example semiconductor memory devices, e.g., erasable programmableread-only memory (EPROM), electrically erasable programmable read-onlymemory (EEPROM), and flash memory devices; magnetic disks, e.g.,internal hard disks or removable disks; magneto optical disks; and CDROM, DVD+/−R, DVD-RAM, and DVD-ROM disks. The memory may store variousobjects or data, including caches, classes, frameworks, applications,backup data, jobs, web pages, web page templates, database tables,repositories storing business and/or dynamic information, and any otherappropriate information including any parameters, variables, algorithms,instructions, rules, constraints, or references thereto. Additionally,the memory may include any other appropriate data, such as logs,policies, security or access data, reporting files, as well as others.The processor and the memory can be supplemented by, or incorporated in,special purpose logic circuitry.

To provide for interaction with a user, implementations of the subjectmatter described in this specification can be implemented on a computerhaving a display device, e.g., a CRT (cathode ray tube), LCD (liquidcrystal display), LED (Light Emitting Diode), or plasma monitor, fordisplaying information to the user and a keyboard and a pointing device,e.g., a mouse, trackball, or trackpad by which the user can provideinput to the computer. Input may also be provided to the computer usinga touchscreen, such as a tablet computer surface with pressuresensitivity, a multi-touch screen using capacitive or electric sensing,or other type of touchscreen. Other kinds of devices can be used toprovide for interaction with a user as well; for example, feedbackprovided to the user can be any form of sensory feedback, e.g., visualfeedback, auditory feedback, or tactile feedback; and input from theuser can be received in any form, including acoustic, speech, or tactileinput. In addition, a computer can interact with a user by sendingdocuments to and receiving documents from a device that is used by theuser; for example, by sending web pages to a web browser on a user'sclient device in response to requests received from the web browser.

The term “graphical user interface,” or “GUI,” may be used in thesingular or the plural to describe one or more graphical user interfacesand each of the displays of a particular graphical user interface.Therefore, a GUI may represent any graphical user interface, includingbut not limited to, a web browser, a touch screen, or a command lineinterface (CLI) that processes information and efficiently presents theinformation results to the user. In general, a GUI may include aplurality of user interface (UI) elements, some or all associated with aweb browser, such as interactive fields, pull-down lists, and buttonsoperable by the business suite user. These and other UI elements may berelated to or represent the functions of the web browser.

Implementations of the subject matter described in this specificationcan be implemented in a computing system that includes a back endcomponent, e.g., as a data server, or that includes a middlewarecomponent, e.g., an application server, or that includes a front-endcomponent, e.g., a client computer having a graphical user interface ora Web browser through which a user can interact with an implementationof the subject matter described in this specification, or anycombination of one or more such back end, middleware, or front endcomponents. The components of the system can be interconnected by anyform or medium of wireline and/or wireless digital data communication,e.g., a communication network. Examples of communication networksinclude a local area network (LAN), a radio access network (RAN), ametropolitan area network (MAN), a wide area network (WAN), WorldwideInteroperability for Microwave Access (WIMAX), a wireless local areanetwork (WLAN) using, for example, 802.11 a/b/g/n and/or 802.20, all ora portion of the Internet, and/or any other communication system orsystems at one or more locations. The network may communicate with, forexample, Internet Protocol (IP) packets, Frame Relay frames,Asynchronous Transfer Mode (ATM) cells, voice, video, data, and/or othersuitable information between network addresses.

The computing system can include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other.

In some implementations, any or all of the components of the computingsystem, both hardware and/or software, may interface with each otherand/or the interface using an application programming interface (API)and/or a service layer. The API may include specifications for routines,data structures, and object classes. The API may be either computerlanguage independent or dependent and refer to a complete interface, asingle function, or even a set of APIs. The service layer providessoftware services to the computing system. The functionality of thevarious components of the computing system may be accessible for allservice consumers via this service layer. Software services providereusable, defined business functionalities through a defined interface.For example, the interface may be software written in JAVA, C++, orother suitable language providing data in extensible markup language(XML) format or other suitable format. The API and/or service layer maybe an integral and/or a stand-alone component in relation to othercomponents of the computing system. Moreover, any or all parts of theservice layer may be implemented as child or sub-modules of anothersoftware module, enterprise application, or hardware module withoutdeparting from the scope of this disclosure.

While this specification contains many specific implementation details,these should not be construed as limitations on the scope of anyinvention or on the scope of what may be claimed, but rather asdescriptions of features that may be specific to particularimplementations of particular inventions. Certain features that aredescribed in this specification in the context of separateimplementations can also be implemented in combination in a singleimplementation. Conversely, various features that are described in thecontext of a single implementation can also be implemented in multipleimplementations separately or in any suitable sub-combination. Moreover,although features may be described above as acting in certaincombinations and even initially claimed as such, one or more featuresfrom a claimed combination can in some cases be excised from thecombination, and the claimed combination may be directed to asub-combination or variation of a sub-combination.

Particular implementations of the subject matter have been described.Other implementations, alterations, and permutations of the describedimplementations are within the scope of the following claims as will beapparent to those skilled in the art. While operations are depicted inthe drawings or claims in a particular order, this should not beunderstood as requiring that such operations be performed in theparticular order shown or in sequential order, or that all illustratedoperations be performed (some operations may be considered optional), toachieve desirable results. In certain circumstances, multitasking and/orparallel processing may be advantageous and performed as deemedappropriate.

Moreover, the separation and/or integration of various system modulesand components in the implementations described above should not beunderstood as requiring such separation and/or integration in allimplementations, and it should be understood that the described programcomponents and systems can generally be integrated together in a singlesoftware product or packaged into multiple software products.

Accordingly, the above description of example implementations does notdefine or constrain this disclosure. Other changes, substitutions, andalterations are also possible without departing from the spirit andscope of this disclosure.

What is claimed is:
 1. A method of performing off-network data capturefrom a mobile device, the method comprising: at a mobile device,receiving data capture configuration information from a wirelessnetwork, the data capture configuration information indicating a datatype to be captured from the mobile device in an off-networkenvironment; after receiving the data capture configuration informationand in response to detecting the off-network environment at the mobiledevice, storing a data element in a local memory of the mobile device,the data element corresponding to the data type indicated by the datacapture configuration information; and sending the data element to thewireless network when the mobile device has access to the wirelessnetwork.
 2. The method of claim 1, wherein detecting the off-networkenvironment at the mobile device comprises detecting that the mobiledevice is outside of radio coverage provided by the wireless network. 3.The method of claim 1, wherein detecting the off-network environment atthe mobile device comprises detecting that the mobile device isutilizing proximity-based wireless services.
 4. The method of claim 1,wherein the data capture configuration information indicates a timeparameter for capturing data in the off-network environment.
 5. Themethod of claim 1, wherein the data capture configuration informationindicates a location parameter for capturing data in the off-networkenvironment.
 6. The method of claim 1, wherein the data captureconfiguration information indicates control plane data to be capturedfrom the mobile device in an off-network environment.
 7. The method ofclaim 1, wherein the data capture configuration information indicatesuser plane data to be captured from the mobile device in an off-networkenvironment.
 8. The method of claim 1, wherein the data element is sentto the wireless network in response to detecting an upload condition atthe mobile device while the mobile device has access to the mobilenetwork.
 9. The method of claim 8, wherein detecting the uploadcondition comprises detecting a radio resource control of the mobiledevice being in a connected mode to communicate data other than the dataelement.
 10. The method of claim 8, wherein detecting the uploadcondition comprises detecting an uplink control plane message to betransmitted by the mobile device.
 11. A mobile device comprising: adata-processing apparatus; and memory storing instructions that areoperable, when executed by the data-processing apparatus, to cause themobile device to perform operations comprising: receiving data captureconfiguration information from a wireless network, the data captureconfiguration information indicating a data type to be captured from themobile device in an off-network environment; after receiving the datacapture configuration information and in response to detecting theoff-network environment at the mobile device, storing a data element ina local memory of the mobile device, the data element corresponding tothe data type indicated by the data capture configuration information;and sending the data element to the wireless network when the mobiledevice has access to the wireless network.
 12. The mobile device ofclaim 11, wherein detecting the off-network environment at the mobiledevice comprises detecting that the mobile device is outside of radiocoverage provided by the wireless network.
 13. The mobile device ofclaim 11, wherein detecting the off-network environment at the mobiledevice comprises detecting that the mobile device is utilizingproximity-based wireless services.
 14. The mobile device of claim 11,wherein the data capture configuration information indicates controlplane data to be captured from the mobile device in an off-networkenvironment.
 15. The mobile device of claim 11, wherein the data captureconfiguration information indicates user plane data to be captured fromthe mobile device in an off-network environment.
 16. The mobile deviceof claim 11, wherein the data element is sent to the wireless network inresponse to detecting an upload condition at the mobile device while themobile device has access to the mobile network.
 17. The mobile device ofclaim 16, wherein detecting the upload condition comprises detecting aradio resource control of the mobile device being in a connected mode tocommunicate data other than the data element.
 18. The mobile device ofclaim 16, wherein detecting the upload condition comprises detecting anuplink control plane message to be transmitted by the mobile device. 19.A wireless network system comprising: a data-processing apparatus; andmemory storing instructions that are operable, when executed by thedata-processing apparatus, to cause the wireless network to performoperations comprising: sending data capture configuration information toa mobile device, the data capture configuration information indicating adata type to be captured from the mobile device in an off-networkenvironment, the mobile device being configured to store a data elementin a local memory of the mobile device in response to the mobile devicedetecting the off-network environment after receiving the data captureconfiguration information; and receiving the data element from themobile device when the mobile device has access to the wireless network.20. The wireless network system of claim 19, wherein receiving the dataelement comprises receiving a data element that was obtained by themobile device when the mobile device was outside of radio coverageprovided by the wireless network.
 21. The wireless network system ofclaim 19, wherein receiving the data element comprises receiving a dataelement that was obtained by the mobile device when the mobile devicewas utilizing proximity-based wireless services.